2
/* png.c - location for general purpose libpng functions
4
* Last changed in libpng 1.4.2 [May 6, 2010]
5
* Copyright (c) 1998-2010 Glenn Randers-Pehrson
6
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
7
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
9
* This code is released under the libpng license.
10
* For conditions of distribution and use, see the disclaimer
11
* and license in png.h
15
#define PNG_NO_PEDANTIC_WARNINGS
19
/* Generate a compiler error if there is an old png.h in the search path. */
20
typedef version_1_4_4 Your_png_h_is_not_version_1_4_4;
22
/* Version information for C files. This had better match the version
23
* string defined in png.h.
26
/* Tells libpng that we have already handled the first "num_bytes" bytes
27
* of the PNG file signature. If the PNG data is embedded into another
28
* stream we can set num_bytes = 8 so that libpng will not attempt to read
29
* or write any of the magic bytes before it starts on the IHDR.
32
#ifdef PNG_READ_SUPPORTED
34
png_set_sig_bytes(png_structp png_ptr, int num_bytes)
36
png_debug(1, "in png_set_sig_bytes");
42
png_error(png_ptr, "Too many bytes for PNG signature");
44
png_ptr->sig_bytes = (png_byte)(num_bytes < 0 ? 0 : num_bytes);
47
/* Checks whether the supplied bytes match the PNG signature. We allow
48
* checking less than the full 8-byte signature so that those apps that
49
* already read the first few bytes of a file to determine the file type
50
* can simply check the remaining bytes for extra assurance. Returns
51
* an integer less than, equal to, or greater than zero if sig is found,
52
* respectively, to be less than, to match, or be greater than the correct
53
* PNG signature (this is the same behaviour as strcmp, memcmp, etc).
56
png_sig_cmp(png_bytep sig, png_size_t start, png_size_t num_to_check)
58
png_byte png_signature[8] = {137, 80, 78, 71, 13, 10, 26, 10};
61
else if (num_to_check < 1)
67
if (start + num_to_check > 8)
68
num_to_check = 8 - start;
70
return ((int)(png_memcmp(&sig[start], &png_signature[start], num_to_check)));
73
#endif /* PNG_READ_SUPPORTED */
75
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
76
/* Function to allocate memory for zlib and clear it to 0. */
78
png_zalloc(voidpf png_ptr, uInt items, uInt size)
81
png_structp p=(png_structp)png_ptr;
82
png_uint_32 save_flags=p->flags;
83
png_alloc_size_t num_bytes;
87
if (items > PNG_UINT_32_MAX/size)
89
png_warning (p, "Potential overflow in png_zalloc()");
92
num_bytes = (png_alloc_size_t)items * size;
94
p->flags|=PNG_FLAG_MALLOC_NULL_MEM_OK;
95
ptr = (png_voidp)png_malloc((png_structp)png_ptr, num_bytes);
101
/* Function to free memory for zlib */
103
png_zfree(voidpf png_ptr, voidpf ptr)
105
png_free((png_structp)png_ptr, (png_voidp)ptr);
108
/* Reset the CRC variable to 32 bits of 1's. Care must be taken
109
* in case CRC is > 32 bits to leave the top bits 0.
112
png_reset_crc(png_structp png_ptr)
114
png_ptr->crc = crc32(0, Z_NULL, 0);
117
/* Calculate the CRC over a section of data. We can only pass as
118
* much data to this routine as the largest single buffer size. We
119
* also check that this data will actually be used before going to the
120
* trouble of calculating it.
123
png_calculate_crc(png_structp png_ptr, png_bytep ptr, png_size_t length)
127
if (png_ptr->chunk_name[0] & 0x20) /* ancillary */
129
if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==
130
(PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))
135
if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)
140
png_ptr->crc = crc32(png_ptr->crc, ptr, (uInt)length);
143
/* Allocate the memory for an info_struct for the application. We don't
144
* really need the png_ptr, but it could potentially be useful in the
145
* future. This should be used in favour of malloc(png_sizeof(png_info))
146
* and png_info_init() so that applications that want to use a shared
147
* libpng don't have to be recompiled if png_info changes size.
150
png_create_info_struct(png_structp png_ptr)
154
png_debug(1, "in png_create_info_struct");
159
#ifdef PNG_USER_MEM_SUPPORTED
160
info_ptr = (png_infop)png_create_struct_2(PNG_STRUCT_INFO,
161
png_ptr->malloc_fn, png_ptr->mem_ptr);
163
info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
165
if (info_ptr != NULL)
166
png_info_init_3(&info_ptr, png_sizeof(png_info));
171
/* This function frees the memory associated with a single info struct.
172
* Normally, one would use either png_destroy_read_struct() or
173
* png_destroy_write_struct() to free an info struct, but this may be
174
* useful for some applications.
177
png_destroy_info_struct(png_structp png_ptr, png_infopp info_ptr_ptr)
179
png_infop info_ptr = NULL;
181
png_debug(1, "in png_destroy_info_struct");
186
if (info_ptr_ptr != NULL)
187
info_ptr = *info_ptr_ptr;
189
if (info_ptr != NULL)
191
png_info_destroy(png_ptr, info_ptr);
193
#ifdef PNG_USER_MEM_SUPPORTED
194
png_destroy_struct_2((png_voidp)info_ptr, png_ptr->free_fn,
197
png_destroy_struct((png_voidp)info_ptr);
199
*info_ptr_ptr = NULL;
203
/* Initialize the info structure. This is now an internal function (0.89)
204
* and applications using it are urged to use png_create_info_struct()
209
png_info_init_3(png_infopp ptr_ptr, png_size_t png_info_struct_size)
211
png_infop info_ptr = *ptr_ptr;
213
png_debug(1, "in png_info_init_3");
215
if (info_ptr == NULL)
218
if (png_sizeof(png_info) > png_info_struct_size)
220
png_destroy_struct(info_ptr);
221
info_ptr = (png_infop)png_create_struct(PNG_STRUCT_INFO);
225
/* Set everything to 0 */
226
png_memset(info_ptr, 0, png_sizeof(png_info));
230
png_data_freer(png_structp png_ptr, png_infop info_ptr,
231
int freer, png_uint_32 mask)
233
png_debug(1, "in png_data_freer");
235
if (png_ptr == NULL || info_ptr == NULL)
238
if (freer == PNG_DESTROY_WILL_FREE_DATA)
239
info_ptr->free_me |= mask;
240
else if (freer == PNG_USER_WILL_FREE_DATA)
241
info_ptr->free_me &= ~mask;
244
"Unknown freer parameter in png_data_freer");
248
png_free_data(png_structp png_ptr, png_infop info_ptr, png_uint_32 mask,
251
png_debug(1, "in png_free_data");
253
if (png_ptr == NULL || info_ptr == NULL)
256
#ifdef PNG_TEXT_SUPPORTED
257
/* Free text item num or (if num == -1) all text items */
258
if ((mask & PNG_FREE_TEXT) & info_ptr->free_me)
262
if (info_ptr->text && info_ptr->text[num].key)
264
png_free(png_ptr, info_ptr->text[num].key);
265
info_ptr->text[num].key = NULL;
271
for (i = 0; i < info_ptr->num_text; i++)
272
png_free_data(png_ptr, info_ptr, PNG_FREE_TEXT, i);
273
png_free(png_ptr, info_ptr->text);
274
info_ptr->text = NULL;
275
info_ptr->num_text=0;
280
#ifdef PNG_tRNS_SUPPORTED
281
/* Free any tRNS entry */
282
if ((mask & PNG_FREE_TRNS) & info_ptr->free_me)
284
png_free(png_ptr, info_ptr->trans_alpha);
285
info_ptr->trans_alpha = NULL;
286
info_ptr->valid &= ~PNG_INFO_tRNS;
290
#ifdef PNG_sCAL_SUPPORTED
291
/* Free any sCAL entry */
292
if ((mask & PNG_FREE_SCAL) & info_ptr->free_me)
294
#if defined(PNG_FIXED_POINT_SUPPORTED) && !defined(PNG_FLOATING_POINT_SUPPORTED)
295
png_free(png_ptr, info_ptr->scal_s_width);
296
png_free(png_ptr, info_ptr->scal_s_height);
297
info_ptr->scal_s_width = NULL;
298
info_ptr->scal_s_height = NULL;
300
info_ptr->valid &= ~PNG_INFO_sCAL;
304
#ifdef PNG_pCAL_SUPPORTED
305
/* Free any pCAL entry */
306
if ((mask & PNG_FREE_PCAL) & info_ptr->free_me)
308
png_free(png_ptr, info_ptr->pcal_purpose);
309
png_free(png_ptr, info_ptr->pcal_units);
310
info_ptr->pcal_purpose = NULL;
311
info_ptr->pcal_units = NULL;
312
if (info_ptr->pcal_params != NULL)
315
for (i = 0; i < (int)info_ptr->pcal_nparams; i++)
317
png_free(png_ptr, info_ptr->pcal_params[i]);
318
info_ptr->pcal_params[i] = NULL;
320
png_free(png_ptr, info_ptr->pcal_params);
321
info_ptr->pcal_params = NULL;
323
info_ptr->valid &= ~PNG_INFO_pCAL;
327
#ifdef PNG_iCCP_SUPPORTED
328
/* Free any iCCP entry */
329
if ((mask & PNG_FREE_ICCP) & info_ptr->free_me)
331
png_free(png_ptr, info_ptr->iccp_name);
332
png_free(png_ptr, info_ptr->iccp_profile);
333
info_ptr->iccp_name = NULL;
334
info_ptr->iccp_profile = NULL;
335
info_ptr->valid &= ~PNG_INFO_iCCP;
339
#ifdef PNG_sPLT_SUPPORTED
340
/* Free a given sPLT entry, or (if num == -1) all sPLT entries */
341
if ((mask & PNG_FREE_SPLT) & info_ptr->free_me)
345
if (info_ptr->splt_palettes)
347
png_free(png_ptr, info_ptr->splt_palettes[num].name);
348
png_free(png_ptr, info_ptr->splt_palettes[num].entries);
349
info_ptr->splt_palettes[num].name = NULL;
350
info_ptr->splt_palettes[num].entries = NULL;
355
if (info_ptr->splt_palettes_num)
358
for (i = 0; i < (int)info_ptr->splt_palettes_num; i++)
359
png_free_data(png_ptr, info_ptr, PNG_FREE_SPLT, i);
361
png_free(png_ptr, info_ptr->splt_palettes);
362
info_ptr->splt_palettes = NULL;
363
info_ptr->splt_palettes_num = 0;
365
info_ptr->valid &= ~PNG_INFO_sPLT;
370
#ifdef PNG_UNKNOWN_CHUNKS_SUPPORTED
371
if (png_ptr->unknown_chunk.data)
373
png_free(png_ptr, png_ptr->unknown_chunk.data);
374
png_ptr->unknown_chunk.data = NULL;
377
if ((mask & PNG_FREE_UNKN) & info_ptr->free_me)
381
if (info_ptr->unknown_chunks)
383
png_free(png_ptr, info_ptr->unknown_chunks[num].data);
384
info_ptr->unknown_chunks[num].data = NULL;
391
if (info_ptr->unknown_chunks_num)
393
for (i = 0; i < (int)info_ptr->unknown_chunks_num; i++)
394
png_free_data(png_ptr, info_ptr, PNG_FREE_UNKN, i);
396
png_free(png_ptr, info_ptr->unknown_chunks);
397
info_ptr->unknown_chunks = NULL;
398
info_ptr->unknown_chunks_num = 0;
404
#ifdef PNG_hIST_SUPPORTED
405
/* Free any hIST entry */
406
if ((mask & PNG_FREE_HIST) & info_ptr->free_me)
408
png_free(png_ptr, info_ptr->hist);
409
info_ptr->hist = NULL;
410
info_ptr->valid &= ~PNG_INFO_hIST;
414
/* Free any PLTE entry that was internally allocated */
415
if ((mask & PNG_FREE_PLTE) & info_ptr->free_me)
417
png_zfree(png_ptr, info_ptr->palette);
418
info_ptr->palette = NULL;
419
info_ptr->valid &= ~PNG_INFO_PLTE;
420
info_ptr->num_palette = 0;
423
#ifdef PNG_INFO_IMAGE_SUPPORTED
424
/* Free any image bits attached to the info structure */
425
if ((mask & PNG_FREE_ROWS) & info_ptr->free_me)
427
if (info_ptr->row_pointers)
430
for (row = 0; row < (int)info_ptr->height; row++)
432
png_free(png_ptr, info_ptr->row_pointers[row]);
433
info_ptr->row_pointers[row] = NULL;
435
png_free(png_ptr, info_ptr->row_pointers);
436
info_ptr->row_pointers = NULL;
438
info_ptr->valid &= ~PNG_INFO_IDAT;
443
info_ptr->free_me &= ~mask;
445
info_ptr->free_me &= ~(mask & ~PNG_FREE_MUL);
448
/* This is an internal routine to free any memory that the info struct is
449
* pointing to before re-using it or freeing the struct itself. Recall
450
* that png_free() checks for NULL pointers for us.
453
png_info_destroy(png_structp png_ptr, png_infop info_ptr)
455
png_debug(1, "in png_info_destroy");
457
png_free_data(png_ptr, info_ptr, PNG_FREE_ALL, -1);
459
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
460
if (png_ptr->num_chunk_list)
462
png_free(png_ptr, png_ptr->chunk_list);
463
png_ptr->chunk_list = NULL;
464
png_ptr->num_chunk_list = 0;
468
png_info_init_3(&info_ptr, png_sizeof(png_info));
470
#endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
472
/* This function returns a pointer to the io_ptr associated with the user
473
* functions. The application should free any memory associated with this
474
* pointer before png_write_destroy() or png_read_destroy() are called.
477
png_get_io_ptr(png_structp png_ptr)
481
return (png_ptr->io_ptr);
484
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
485
#ifdef PNG_STDIO_SUPPORTED
486
/* Initialize the default input/output functions for the PNG file. If you
487
* use your own read or write routines, you can call either png_set_read_fn()
488
* or png_set_write_fn() instead of png_init_io(). If you have defined
489
* PNG_NO_STDIO, you must use a function of your own because "FILE *" isn't
490
* necessarily available.
493
png_init_io(png_structp png_ptr, png_FILE_p fp)
495
png_debug(1, "in png_init_io");
500
png_ptr->io_ptr = (png_voidp)fp;
504
#ifdef PNG_TIME_RFC1123_SUPPORTED
505
/* Convert the supplied time into an RFC 1123 string suitable for use in
506
* a "Creation Time" or other text-based time string.
509
png_convert_to_rfc1123(png_structp png_ptr, png_timep ptime)
511
static PNG_CONST char short_months[12][4] =
512
{"Jan", "Feb", "Mar", "Apr", "May", "Jun",
513
"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
517
if (png_ptr->time_buffer == NULL)
519
png_ptr->time_buffer = (png_charp)png_malloc(png_ptr, (png_uint_32)(29*
523
#ifdef USE_FAR_KEYWORD
525
char near_time_buf[29];
526
png_snprintf6(near_time_buf, 29, "%d %s %d %02d:%02d:%02d +0000",
527
ptime->day % 32, short_months[(ptime->month - 1) % 12],
528
ptime->year, ptime->hour % 24, ptime->minute % 60,
530
png_memcpy(png_ptr->time_buffer, near_time_buf,
531
29*png_sizeof(char));
534
png_snprintf6(png_ptr->time_buffer, 29, "%d %s %d %02d:%02d:%02d +0000",
535
ptime->day % 32, short_months[(ptime->month - 1) % 12],
536
ptime->year, ptime->hour % 24, ptime->minute % 60,
539
return ((png_charp)png_ptr->time_buffer);
541
#endif /* PNG_TIME_RFC1123_SUPPORTED */
543
#endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
546
png_get_copyright(png_structp png_ptr)
548
png_ptr = png_ptr; /* Silence compiler warning about unused png_ptr */
549
#ifdef PNG_STRING_COPYRIGHT
550
return PNG_STRING_COPYRIGHT
553
return ((png_charp) PNG_STRING_NEWLINE \
554
"libpng version 1.4.4 - September 23, 2010" PNG_STRING_NEWLINE \
555
"Copyright (c) 1998-2010 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \
556
"Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \
557
"Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \
560
return ((png_charp) "libpng version 1.4.4 - September 23, 2010\
561
Copyright (c) 1998-2010 Glenn Randers-Pehrson\
562
Copyright (c) 1996-1997 Andreas Dilger\
563
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.");
568
/* The following return the library version as a short string in the
569
* format 1.0.0 through 99.99.99zz. To get the version of *.h files
570
* used with your application, print out PNG_LIBPNG_VER_STRING, which
571
* is defined in png.h.
572
* Note: now there is no difference between png_get_libpng_ver() and
573
* png_get_header_ver(). Due to the version_nn_nn_nn typedef guard,
574
* it is guaranteed that png.c uses the correct version of png.h.
577
png_get_libpng_ver(png_structp png_ptr)
579
/* Version of *.c files used when building libpng */
580
png_ptr = png_ptr; /* Silence compiler warning about unused png_ptr */
581
return ((png_charp) PNG_LIBPNG_VER_STRING);
585
png_get_header_ver(png_structp png_ptr)
587
/* Version of *.h files used when building libpng */
588
png_ptr = png_ptr; /* Silence compiler warning about unused png_ptr */
589
return ((png_charp) PNG_LIBPNG_VER_STRING);
593
png_get_header_version(png_structp png_ptr)
595
/* Returns longer string containing both version and date */
596
png_ptr = png_ptr; /* Silence compiler warning about unused png_ptr */
598
return ((png_charp) PNG_HEADER_VERSION_STRING
599
#ifndef PNG_READ_SUPPORTED
604
return ((png_charp) PNG_HEADER_VERSION_STRING);
608
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
609
#ifdef PNG_HANDLE_AS_UNKNOWN_SUPPORTED
611
png_handle_as_unknown(png_structp png_ptr, png_bytep chunk_name)
613
/* Check chunk_name and return "keep" value if it's on the list, else 0 */
616
if (png_ptr == NULL || chunk_name == NULL || png_ptr->num_chunk_list<=0)
618
p = png_ptr->chunk_list + png_ptr->num_chunk_list*5 - 5;
619
for (i = png_ptr->num_chunk_list; i; i--, p -= 5)
620
if (!png_memcmp(chunk_name, p, 4))
621
return ((int)*(p + 4));
625
#endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */
627
#ifdef PNG_READ_SUPPORTED
628
/* This function, added to libpng-1.0.6g, is untested. */
630
png_reset_zstream(png_structp png_ptr)
633
return Z_STREAM_ERROR;
634
return (inflateReset(&png_ptr->zstream));
636
#endif /* PNG_READ_SUPPORTED */
638
/* This function was added to libpng-1.0.7 */
640
png_access_version_number(void)
642
/* Version of *.c files used when building libpng */
643
return((png_uint_32) PNG_LIBPNG_VER);
648
#if defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED)
650
/* Added at libpng version 1.2.6 */
651
PNG_EXTERN png_size_t PNGAPI png_convert_size PNGARG((size_t size));
653
png_convert_size(size_t size)
655
if (size > (png_size_t)-1)
656
PNG_ABORT(); /* We haven't got access to png_ptr, so no png_error() */
657
return ((png_size_t)size);
659
#endif /* PNG_SIZE_T */
661
/* Added at libpng version 1.2.34 and 1.4.0 (moved from pngset.c) */
662
#ifdef PNG_cHRM_SUPPORTED
663
#ifdef PNG_CHECK_cHRM_SUPPORTED
666
* Multiply two 32-bit numbers, V1 and V2, using 32-bit
667
* arithmetic, to produce a 64 bit result in the HI/LO words.
675
* where A and B are the high and low 16-bit words of V1,
676
* C and D are the 16-bit words of V2, AD is the product of
677
* A and D, and X || Y is (X << 16) + Y.
681
png_64bit_product (long v1, long v2, unsigned long *hi_product,
682
unsigned long *lo_product)
687
a = (v1 >> 16) & 0xffff;
689
c = (v2 >> 16) & 0xffff;
693
x = a * d + c * b; /* AD + CB */
694
y = ((lo >> 16) & 0xffff) + x;
696
lo = (lo & 0xffff) | ((y & 0xffff) << 16);
697
hi = (y >> 16) & 0xffff;
699
hi += a * c; /* AC */
701
*hi_product = (unsigned long)hi;
702
*lo_product = (unsigned long)lo;
706
png_check_cHRM_fixed(png_structp png_ptr,
707
png_fixed_point white_x, png_fixed_point white_y, png_fixed_point red_x,
708
png_fixed_point red_y, png_fixed_point green_x, png_fixed_point green_y,
709
png_fixed_point blue_x, png_fixed_point blue_y)
712
unsigned long xy_hi,xy_lo,yx_hi,yx_lo;
714
png_debug(1, "in function png_check_cHRM_fixed");
719
if (white_x < 0 || white_y <= 0 ||
720
red_x < 0 || red_y < 0 ||
721
green_x < 0 || green_y < 0 ||
722
blue_x < 0 || blue_y < 0)
725
"Ignoring attempt to set negative chromaticity value");
728
if (white_x > (png_fixed_point) PNG_UINT_31_MAX ||
729
white_y > (png_fixed_point) PNG_UINT_31_MAX ||
730
red_x > (png_fixed_point) PNG_UINT_31_MAX ||
731
red_y > (png_fixed_point) PNG_UINT_31_MAX ||
732
green_x > (png_fixed_point) PNG_UINT_31_MAX ||
733
green_y > (png_fixed_point) PNG_UINT_31_MAX ||
734
blue_x > (png_fixed_point) PNG_UINT_31_MAX ||
735
blue_y > (png_fixed_point) PNG_UINT_31_MAX )
738
"Ignoring attempt to set chromaticity value exceeding 21474.83");
741
if (white_x > 100000L - white_y)
743
png_warning(png_ptr, "Invalid cHRM white point");
746
if (red_x > 100000L - red_y)
748
png_warning(png_ptr, "Invalid cHRM red point");
751
if (green_x > 100000L - green_y)
753
png_warning(png_ptr, "Invalid cHRM green point");
756
if (blue_x > 100000L - blue_y)
758
png_warning(png_ptr, "Invalid cHRM blue point");
762
png_64bit_product(green_x - red_x, blue_y - red_y, &xy_hi, &xy_lo);
763
png_64bit_product(green_y - red_y, blue_x - red_x, &yx_hi, &yx_lo);
765
if (xy_hi == yx_hi && xy_lo == yx_lo)
768
"Ignoring attempt to set cHRM RGB triangle with zero area");
774
#endif /* PNG_CHECK_cHRM_SUPPORTED */
775
#endif /* PNG_cHRM_SUPPORTED */
778
png_check_IHDR(png_structp png_ptr,
779
png_uint_32 width, png_uint_32 height, int bit_depth,
780
int color_type, int interlace_type, int compression_type,
785
/* Check for width and height valid values */
788
png_warning(png_ptr, "Image width is zero in IHDR");
794
png_warning(png_ptr, "Image height is zero in IHDR");
798
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
799
if (width > png_ptr->user_width_max || width > PNG_USER_WIDTH_MAX)
801
if (width > PNG_USER_WIDTH_MAX)
804
png_warning(png_ptr, "Image width exceeds user limit in IHDR");
808
#ifdef PNG_SET_USER_LIMITS_SUPPORTED
809
if (height > png_ptr->user_height_max || height > PNG_USER_HEIGHT_MAX)
811
if (height > PNG_USER_HEIGHT_MAX)
814
png_warning(png_ptr, "Image height exceeds user limit in IHDR");
818
if (width > PNG_UINT_31_MAX)
820
png_warning(png_ptr, "Invalid image width in IHDR");
824
if ( height > PNG_UINT_31_MAX)
826
png_warning(png_ptr, "Invalid image height in IHDR");
830
if ( width > (PNG_UINT_32_MAX
831
>> 3) /* 8-byte RGBA pixels */
832
- 64 /* bigrowbuf hack */
833
- 1 /* filter byte */
834
- 7*8 /* rounding of width to multiple of 8 pixels */
835
- 8) /* extra max_pixel_depth pad */
836
png_warning(png_ptr, "Width is too large for libpng to process pixels");
838
/* Check other values */
839
if (bit_depth != 1 && bit_depth != 2 && bit_depth != 4 &&
840
bit_depth != 8 && bit_depth != 16)
842
png_warning(png_ptr, "Invalid bit depth in IHDR");
846
if (color_type < 0 || color_type == 1 ||
847
color_type == 5 || color_type > 6)
849
png_warning(png_ptr, "Invalid color type in IHDR");
853
if (((color_type == PNG_COLOR_TYPE_PALETTE) && bit_depth > 8) ||
854
((color_type == PNG_COLOR_TYPE_RGB ||
855
color_type == PNG_COLOR_TYPE_GRAY_ALPHA ||
856
color_type == PNG_COLOR_TYPE_RGB_ALPHA) && bit_depth < 8))
858
png_warning(png_ptr, "Invalid color type/bit depth combination in IHDR");
862
if (interlace_type >= PNG_INTERLACE_LAST)
864
png_warning(png_ptr, "Unknown interlace method in IHDR");
868
if (compression_type != PNG_COMPRESSION_TYPE_BASE)
870
png_warning(png_ptr, "Unknown compression method in IHDR");
874
#ifdef PNG_MNG_FEATURES_SUPPORTED
875
/* Accept filter_method 64 (intrapixel differencing) only if
876
* 1. Libpng was compiled with PNG_MNG_FEATURES_SUPPORTED and
877
* 2. Libpng did not read a PNG signature (this filter_method is only
878
* used in PNG datastreams that are embedded in MNG datastreams) and
879
* 3. The application called png_permit_mng_features with a mask that
880
* included PNG_FLAG_MNG_FILTER_64 and
881
* 4. The filter_method is 64 and
882
* 5. The color_type is RGB or RGBA
884
if ((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) &&
885
png_ptr->mng_features_permitted)
886
png_warning(png_ptr, "MNG features are not allowed in a PNG datastream");
888
if (filter_type != PNG_FILTER_TYPE_BASE)
890
if (!((png_ptr->mng_features_permitted & PNG_FLAG_MNG_FILTER_64) &&
891
(filter_type == PNG_INTRAPIXEL_DIFFERENCING) &&
892
((png_ptr->mode & PNG_HAVE_PNG_SIGNATURE) == 0) &&
893
(color_type == PNG_COLOR_TYPE_RGB ||
894
color_type == PNG_COLOR_TYPE_RGB_ALPHA)))
896
png_warning(png_ptr, "Unknown filter method in IHDR");
900
if (png_ptr->mode & PNG_HAVE_PNG_SIGNATURE)
902
png_warning(png_ptr, "Invalid filter method in IHDR");
908
if (filter_type != PNG_FILTER_TYPE_BASE)
910
png_warning(png_ptr, "Unknown filter method in IHDR");
916
png_error(png_ptr, "Invalid IHDR data");
918
#endif /* defined(PNG_READ_SUPPORTED) || defined(PNG_WRITE_SUPPORTED) */